[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Recommendation for Random Bit Generator (RBG) Constructions:

......................21              |
| 2.8.3.1. Instantiating a DRBG Within an RBG3 Construction.............................................................21                          |
| 2.8.3.2.
Generation Using an RBG3 Construction..............................................................................23                    |
| 3. Accessing Entropy Source Output                                                                                |
| .................................................................................................26                                               |
| 3.2.1.1. Keys Used in External Conditioning Functions......................................................................29                     |
| 3.2.1.2. Hash Function-Based Conditioning Functions......................................................................30                       |
| 3.2.1.3. Block Cipher-Based Conditioning Functions.........................................................................30                     |
| 3.2.2. Using a Vetted Conditioning Function........................................................................................31             |
| 3.2.2.1. External Conditioning When Full Entropy is Not Required...................................................31                             |
| 3.2.2.2. Conditioning Function to Obtain Full-Entropy Bitstrings......................................................33                          |

Recommendation for Random Bit Generator (RBG) Constructions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. Computing devices that integrate physical and/or sensing capabilities and network interface capabilities are being designed, developed, and deployed at an ever-increasing pace. These devices are fulfilling customer needs in all sectors of the economy. Many of these computing devices are connected to the internet. A novel characteristic of these devices is the combination of connectivity and the ability to sense and/or affect the physical world. As devices become smaller and more complex, with an increasing number of features, the security of those devices also becomes more complex. This publication defines a baseline set of device cybersecurity capabilities that organizations should consider when confronting the challenge of the Internet of Things (IoT).

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Information Security Handbook_ A Guide for Managers:

| |------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------| | | Purpose | and Applicability............................................................................................1 | | | | | Relationship to Existing Guidance...............................................................................1 | | | | | Audience .....................................................................................................................1 | | | 2.

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Computer Security Training & Awareness Course Compendium:

## Computer Security Training & Awareness Course Compendium

## Computer Security Training & Awareness Course Compendium

This National Institute of Standards and Technology (NIST) Interagency Report (NISTIR) is a compendium of computer security training and awareness courses. The purpose of this publication is to assist federal agencies locate computer security training resources. This publication is part of a continuing NIST effort to support federal agencies in accordance with NIST's mandate under the Computer Security Act of 1987. In addition to the table of contents, which lists the courses, there are four appendices: A) lists the courses by training areas within audience categories as defined in NIST Special Publication 500-172, Computer Security Training Guidelines: B) lists the vendors that participated in this effort; C) lists the specific products for which training is available; and D) lists the product specific courses.

Computer Security Training & Awareness Course Compendium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

Type.............................................................98 | | | C.3.5.8 System and Network Monitoring Information Type...............................................100 | | | C.3.5.9 Information Sharing Information Type...................................................................101 | | | APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED INFORMATION AND INFORMATION SYSTEMS......................................................102 | | | D.2 Homeland Security..............................................................................................................

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide? (Part 2)

[Assistant]
er statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.
This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-56B Revision 2 Natl. Inst. Stand. Technol. Spec. Publ. 800-56B Rev. 2, 131 pages (March 2019) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-56Br2

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1 provide? (Part 4)

[Assistant]
-------------------------------------------------------|
| 1. Introduction ........................................................................................................................ | 1.
Introduction ........................................................................................................................ | 1. Introduction ........................................................................................................................

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Threat Assessment of Malicious Code and External Attacks:

3.4.1                 | Configuration Errors and Passwords |  13 |
|                  |                  | 3. 3.4.1 Configuration Errors and Passwords

Today, desktop workstations are becoming the tool of more and more scientists and professionals.

Threat Assessment of Malicious Code and External Attacks


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities provide? (Part 3)

[Assistant]
l Institute of Standards and Technology would also like to express its appreciation and thanks to the Department of Homeland Security for its sponsorship and support of NIST Special Publication 80084.
## Table of Contents

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1        | Executive Summary..............................................................................................................ES-1                                                                                | Executive Summary..............................................................................................................ES-1        |
|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
| 1.

Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

5 AU-4, CP- 2, SC-5                                                                                | Double extortion - demanding payment both to restore data access and to not sell or publish the data elsewhere - is common, so data leak prevention solutions are important. |
|                                                                                | PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity ISO/IEC 27001:2013 A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3, A.14.2.4 NIST SP 800-53 Rev. 5 SC-16, SI-                                                                                | Integrity checking mechanisms can detect tampered software updates that can be used to insert malware that enables ransomware events. |
|                                                                                | PR.DS-7: The development and testing environment(s) are separate from the production environment ISO/IEC 27001:2013 A.12.1.4 NIST SP 800-53 Rev.

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

| 5.6.1.2.2 Key Pair Generation by Testing Candidates........................
|   31 |
| 5.6.2 Required Assurances.......................................................................................... | 5.6.2 Required Assurances.......................................................................................... |   32 |
| 5.6.2.1                                                                                | Assurances Required by the Key Pair Owner..................................... |   33 |
|                                                                                | 5.6.2.1.1 Owner Assurance of Correct Generation............................. |   35 |
|                                                                                | 5.6.2.1.2 Owner Assurance of Private-Key Validity .......................... |   35 |
|                                                                                | 5.6.2.1.3 Owner Assurance of Public-Key Validity ........................... |   36 |
|                                                                                | 5.6.2.1.4 Owner Assurance of Pair-wise Consistency........................ |   36 |
|                                                                                | 5.6.2.1.5 Owner Assurance of Possession of the Private Key............ |   37 |
| 5.6.2.2                                                                                | Assurances Required by a Public Key Recipient................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities:

3.3.2 Collateral Damage Potential (CDP)

The Collateral Damage Potential metric measures the potential for loss of life or physical assets through damage or theft of property or equipment.

The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Secure Domain Name System (DNS) Deployment Guide:

7-1 | |------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------| | 7.1 Securing DNS Host Platform ..................................................................................7-1 | 7.1 Securing DNS Host Platform ..................................................................................7-1 | 7.1 Securing DNS Host Platform ..................................................................................7-1 | | | 7.2 Securing DNS Software..........................................................................................7-1 | 7.2 Securing DNS Software..........................................................................................7-1 | 7.2 Securing DNS Software..........................................................................................7-1 | | | | 7.2.1 | Running the Latest Version of Name Server Software ...............................

Secure Domain Name System (DNS) Deployment Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Annual Report 2018_ NIST_ITL Cybersecurity Program:

- Release of the first update of the Framework for Improving Critical Infrastructure Cybersecurity , popularly known as simply the 'Cybersecurity Framework.' First produced in February 2014 with the active involvement of hundreds of organizations in the private and public sectors, Version 1.1 was released in April 2018. Based on the experience of Framework users and changes in the cybersecurity environment and technological advances, the revision added more content related to supply chain risk management and coordinated vulnerability disclosure. NIST added and clarified language regarding cybersecurity measurement with an emphasis on self-assessment. The number of downloads of Version 1.1 has far surpassed that of the initial version. - Better preparing an organization's senior leaders to execute the RMF, as well as how to communicate their protection plans and risk management strategies to system implementers and operators. - Incorporating supply chain risk management considerations . The RMF now addresses growing supply chain concerns, such as counterfeit components, tampering, theft, insertion of malicious software and hardware, poor manufacturing and development practices, and other potentially harmful activities that can impact an organization's systems and systems components. - Supporting security and privacy safeguards . The RMF update provides organizations with a disciplined and structured process to select controls from the newly developed consolidated security and privacy control catalog in NIST's SP 800-53 Revision 5. 7  This should be valuable to companies and organizations beyond the federal government, considering how high profile the subject of privacy has become as of late. - Roots of Trust . Modern computing devices consist of varied hardware, firmware, and software components at multiple layers of abstraction.

Annual Report 2018_ NIST_ITL Cybersecurity Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Security for Full Virtualization Technologies provide? (Part 5)

[Assistant] 1-1 | | | 1.1 | Authority.................................................................................................................1-1 | | | | 1.2 | Purpose and Scope................................................................................................1-1 | | | | 1.3 | Audience ................................................................................................................1-1 | | | | 1.4 | Document Structure ...............................................................................................1-1 | | | 2.

Guide to Security for Full Virtualization Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.3 (NIST 3.5.3)?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

3.5.3 In terms of labelling, this model would require that an object refer to label components addressing classification and designation.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Security Assessment?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

While some ideas for means of addressing these challenges came up during discussions, all need further evaluation to identify the right mix of technical capabilities, manufacturer support, and public education to address.

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.6 (NIST 3.1.6)?

[Assistant]
According to PIV Data Model Test Guidelines:

3.1.6  Verify contents of signerInfos

| Purpose      | Confirms that the signerInfos in the SignedData is populated with a single SignerInfo. 3.1.6: Verify contents of signerInfos                        | The tester shall validate that only a single SignerInfo exists in the SignedData.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to ISCMA_ An Information Security Continuous Monitoring Program Assessment:

65   | References....................................................................................................................... 65   | References.......................................................................................................................

ISCMA_ An Information Security Continuous Monitoring Program Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide? (Part 3)

[Assistant]
aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: SP800-56b\_comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the  cost-effective  security  and  privacy  of  other  than  national  security-related  information  in Federal  information  systems. The  Special  Publication  800-series  reports  on  ITL's  research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

This Recommendation specifies key-establishment schemes using integer factorization cryptography (in particular, RSA). Both key-agreement and key transport schemes are specified for pairs of entities, and methods for key confirmation are included to provide assurance that both parties share the same keying material. In addition, the security properties associated with each scheme are provided.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Security Assessment?

[Assistant]
According to Hardware Security Failure Scenarios_ Potential Hardware Weaknesses:

1. An attacker with physical access to a chip can leverage a lack of or faults in debug/test interface access control to read and set registers (e.g., via a scan chain using a Joint Test Action Group [JTAG] interface) and bypass normal on-chip protections [CWE-1191]. 2. Malicious code on a device may leverage a lack of granularity in hardware access control to read or modify assets (e.g., device configuration and keys) by taking advantage of unintended privileges [CWE-1220]. 3. New functionality may not be implementable because a programmable lock bit set during the boot process prevents an unnecessarily large address region from being written [CWE-1222]. 4. Malicious code can take advantage of an improper implementation of write-once register bits to reprogram system settings (e.g., boot time configuration) [CWE-1224]. 5. Attackers may unlock a secured system by leveraging design or code errors to modify trusted lock bits that should have their values immutable after the initial set, thereby enabling writes to protected registers or address regions [CWE-1231]. 6. Attackers can gain full read-write access  to a device by accessing undocumented features (typically put there to allow for easy developer testing) that circumvent security controls. These are often implemented as 'chicken bits' - undocumented bits that disable security features [CWE-1242]. 7. Attackers can write malicious code to memory and then execute it because the central processing unit (CPU) does not support a bit that defines read-only and write-only regions of memory. This can also happen if the CPU relies on an improperly configured memory protection unit (MPU) and memory management unit (MMU) for read and write exclusivity [CWE-1252]. 8. Attackers can access protected memory regions and perform both read and write by using memory alias addresses (i.e., redundant addresses that point to the same memory region) or mirrored memory regions that do not have the same protections.

Hardware Security Failure Scenarios_ Potential Hardware Weaknesses


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance provide? (Part 3)

[Assistant]
sured network, device, and operational performance impacts for a process-based manufacturing environment (Volume 2) and a discrete-based manufacturing environment (Volume 3) are included in the guide.
Manufacturers should make their own determinations about the breadth of the proof-of-concept solutions they voluntarily implement. Some important factors to consider include: company size, cybersecurity expertise, risk tolerance, and the threat landscape. The CSF Manufacturing Profile can be used as a roadmap for managing cybersecurity risk for manufacturers and is aligned with manufacturing sector goals and industry best practices. The Manufacturing Profile provides a voluntary, risk-based approach for managing cybersecurity activities and cyber risk to manufacturing systems. The Manufacturing Profile is meant to complement but not replace current cybersecurity standards and industry guidelines that the manufacturer is embracing. ## Keywords

Computer security; Cybersecurity Framework (CSF); distributed control systems (DCS); industrial control systems (ICS); information security; manufacturing; network security; programmable logic controllers (PLC); risk management; security controls; supervisory control and data acquisition (SCADA) systems. ## Supplemental Content

Additional volumes of this publication include:

NISTIR 8183A Volume 2, Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide: Volume 2 - Process-based Manufacturing System Use Case. https://doi.org/10.6028/NIST.IR.8183A-2

NISTIR 8183A Volume 3, Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide: Volume 3 - Discrete-based Manufacturing System Use Case.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does SHA-3 Derived Functions_ cSHAKE, KMAC, TupleHash, and ParallelHash provide?

[Assistant]
## NIST Special Publication 800-185

## SHA-3 Derived Functions:

cSHAKE, KMAC, TupleHash and ParallelHash

John Kelsey Shu-jen Chang Ray Perlner

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-185

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-185

## SHA-3 Derived Functions:

cSHAKE, KMAC, TupleHash and ParallelHash

John Kelsey Shu-jen Chang Ray Perlner Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-185

December 2016

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.)  113-283. NIST  is  responsible  for  developing  information  security  standards  and  guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not  apply  to  national  security  systems  without  the  express  approval  of  appropriate  federal  officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and  binding  on  federal  agencies  by  the  Secretary  of  Commerce  under  statutory  authority. Nor  should these  guidelines  be  interpreted  as  altering  or  superseding  the  existing  authorities  of  the  Secretary  of Commerce,  Director  of  the  OMB,  or  any  other  federal  official. This  publication  may  be  used  by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

SHA-3 Derived Functions_ cSHAKE, KMAC, TupleHash, and ParallelHash


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does General Procedures for Registering Computer Security Objects provide? (Part 4)

[Assistant] ## Table of Contents | 1.0 | Introduction | Introduction | 1 | |-----------------------------------------------|-----------------------------------------------|-----------------------------------------------|-----| | | 1.1 | Purpose | 1 | | | 1.2 | Scope | 1 | | | 1.3 | Overview | 2 | | 2.0 | References | References | 2 | | 3.0 | Definitions and Abbreviations | Definitions and Abbreviations | 2 | | | 3.1 | Definitions | 2 | | | 3.2 | Abbreviations | 3 | | 4.0 | Registration Authority | Registration Authority | 4 | | 5.0 | Criteria for Eligibility | Criteria for Eligibility | 4 | | 6.0 | Processing of Applications | Processing of Applications | 4 | | | 6.1 Application for Registration | 6.1 Application for Registration | 4 | | | 6.2 | Review of Application | 5 | | | 6.3 | Assignment of CSO Names | 6 | | 7.0 | Maintenance of the Register | Maintenance of the Register | 7 | | 8.0 | Supplemental Services | Supplemental Services | 7 | | | 8.1 Register Inquiry | 8.1 Register Inquiry | 7 | | | 8.2 | Register Publication | 8 | | 9.0 | Fees |

General Procedures for Registering Computer Security Objects

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2013 Annual Report provide? (Part 5)

[Assistant]
|
| Small and Medium Size Business (SMB) Outreach                                                                                | ......................
33                                         |
| Cryptographic Technology ...................................................... | 33                                                                |
| Cryptographic Standards Program                                                                                | ............................................ 33                   |
| Cryptographic Research .......................................................... | 36                                                                |
| New Research Areas in Cryptographic Techniques for Emerging Applications ............................................................. | 38                                                                |
| Applied Cryptography .............................................................. | 40                                                                |
| Identity Management                                                                                | .............................................................. 42 |
| Personal Identity Verification (PIV) and FIPS 201 Revision Efforts ...................................................................... | 42                                                                |
| PIV Program Test Cards ........................................................... | 43                                                                |
| NIST Personal Identity Verification Program (NPIVP)                                                                                | ....................

Computer Security Division 2013 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Module-Lattice-Based Digital Signature Standard:

| 1 Introduction                            | 1 Introduction                                             | 1 Introduction                                                         | 1 Introduction                                                         |   1 |
|-------------------------------------------|------------------------------------------------------------|------------------------------------------------------------------------|------------------------------------------------------------------------|-----|
|                                           | 1.1                                                        | Purpose and Scope . . . . . . . . . . . . . . . . . . . . . . | Purpose and Scope . . . . . . . . . . . . . . . . . . . . . . |   1 |
|                                           | 1.2                                                        | Context . . . . . . . . . . . . . . . . . . . . . . . . . | Context . . . . . . . . . . . . . . . . . . . . . . . . . |   1 |
| 2                                         | 2                                                          | Glossary                                                               | of Terms, Acronyms, and Symbols                                        |   2 |
|                                           | 2.1                                                        | Terms and Definitions . . . . . . . . . . . . . . | Terms and Definitions . . . . . . . . . . . . . . |   2 |
|                                           | 2.2                                                        | Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   5 |
|                                           | 2.3                                                        | Mathematical Symbols . . . . . . . . | . . . .

Module-Lattice-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

## 3.3. Optional Data Elements

## 3.3.1. Printed Information

## 3.3.2. Discovery Object

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

- Identify the business or operational environment and organization's purpose. - Identify all assets, including hardware, software, personnel, roles, responsibilities, and the assets' criticality. - Identify infrastructure that provides HSN functionality. - Identify the current and trending vulnerabilities, threats, and impacts should the threat be realized. The data, personnel, devices, systems, and facilities that enable the organization to achieve its business objectives are identified and managed in a manner that is consistent with their importance to organizational objectives and the organization's risk strategy. | Subcategory                                                                                | Applicability to HSNs                                                                                | Informative References                                             |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
| ID.AM-5: Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value.

Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Hash Standard (SHS) provide? (Part 5)

[Assistant]
o Obtain Copies of the Standard : This publication is available electronically by accessing http://csrc.nist.gov/publications/. Other computer security publications are available at the same web site.
## Federal Information

## Processing Standards Publication 180-4

## Specifications for the

## SECURE HASH STANDARD

## Table of Contents

| 1. | INTRODUCTION ...............................................................................................................................................3   | INTRODUCTION ...............................................................................................................................................3   | INTRODUCTION ...............................................................................................................................................3   |
|------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Guide to Storage Encryption Technologies for End User Devices:

3.3.1 Use Case 1: Sharing a Laptop ... 3.3.1 Use Case 1: Sharing a Laptop

Three users share a laptop.

Guide to Storage Encryption Technologies for End User Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog:

| 1 Introduction ............................................................................................................8   | 1 Introduction ............................................................................................................8   |
|--------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | Purpose and Applicability................................................................................ 8                    |
| 1.2                                                                                | Target Audience.............................................................................................. 9                |
|                                                                                | 1.3 Relationship to Other Publications.................................................................. 9                     |
| 1.4                                                                                | Publication Organization.................................................................................

IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products provide? (Part 3)

[Assistant]
| 1.3 Document Scope and Goals...........................................................................
| 2                                                                                |
|                                                                                | 1.4 Document Structure........................................................................................ | 2                                                                                |
| 2                                                                                | Baseline Product Criteria ......................................................................................3               | Baseline Product Criteria ......................................................................................3            |
|                                                                                | 2.1 Scope of an IoT Product                                                                                | ................................................................................. 3                                          |
|                                                                                | 2.2 Recommended Baseline Product                                                                                | Criteria .......................................................

Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Computer Security Division 2003 Annual Report provide?

[Assistant]
<!-- image -->

## TABLE OF CONTENTS

| Welcome Letter                                      | 2   |
|-----------------------------------------------------|-----|
| The Computer Security Division Responds to the      |     |
| Federal Information Security Management Act of 2002 | 3   |
| Outreach, Awareness and Education                   | 4   |
| Security Management and Guidance                    | 8   |
| Security Testing and Metrics                        | 14  |
| Security Research and Emerging Technologies         | 16  |
| Cryptographic Standards and Applications            | 26  |
| Honors and Awards                                   | 32  |
| Computer Security Division Publications - 2003      | 34  |
| Ways to Engage Our Division & NIST                  | 36  |

<!-- image -->

F or many years, the Computer Security Division has made great contributions to help secure our nation's sensitive information and information systems. Our work has paralleled the evolution of  IT , initially  focused  principally  on  mainframe  computers, to now encompass today's wide gamut of information technology devices. Our important responsibilities were re-affirmed by Congress with passage of the Federal Information Security Management Act (FISMA) of 2002 and the Cyber Security Research and Development Act of 2002. Beyond our role to serve the Federal Agencies under FISMA, our standards and guidelines are often voluntarily used by U.S. industry, global industry, and  foreign  governments  as  sources  of  information  and  direction  for securing information systems. Our research also contributes to securing the nation's critical infrastructure systems. Moreover, the Division has an active role in both national and international standards organizations in promoting the interests of security and U.S. industry.

Computer Security Division 2003 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Audit and Accountability?

[Assistant]
According to Computer Security Division 2010 Annual Report:

egisla tion in the federal government, including the Privacy Act of 1974, the Computer Security Act of 1987, the E-Government Act (includ ing FISMA), and other e-government services and initiatives.
We also invite public and private organizations to submit their in formation security practices to be considered for inclusion on the website. Policies and procedures may be submitted to us in any area of information security, such as accreditation, audit trails, au thorization of processing, budget planning and justification, cer tification, contingency planning, data integrity, disaster planning, documentation, hardware and system maintenance, identification and  authentication,  incident  handling  and  response,  life  cycle, network security, personnel security, physical and environmental protection, production input/output controls, security policy, pro gram management, review of security controls, risk management, security  awareness  training  and  education  (including  specific training course and awareness materials), and security planning.

Computer Security Division 2010 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cell Phone Forensic Tools_ an Overview and Analysis:

|
| PDA SEIZURE ............................................................................................................................
| 10                                                                                |
| PILOT-LINK................................................................................................................................ CELL SEIZURE............................................................................................................................ | 11 11                                                                                |
| GSM .XRY                                                                                | ............................................................................................................................... 12               |
| OXYGEN PHONE MANAGER                                                                                | ....................................................................................................... 12                                       |
| MOBILEDIT!.............................................................................................................................

Cell Phone Forensic Tools_ an Overview and Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings:

ping for the secondary relationships. - Mapping can highlight ambiguities with wording, differences in granularity, duplication of concepts, and other issues within either of the sources being mapped.
Be sure to capture and share these observations because they can significantly improve the next version of the affected sources.

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities:

Secure Coding Principles             | . . . . . . . . . . . . |  47 |
|      | 9.1. | Input/Output Check Safety . . . . . . . . . . . . . . . |  47 |
|      | 9.2. | Memory Safety . . . . . . . . . .
|  48 |
|      | 9.3. | Data Type Safety . . . . . . . . . . . . . . . . . . |  50 |
| 10. | BF Tools . . . . . . | . . . . . . . . . . . . . . . |  52 |
|      | 10.1. BFCWE Tool 10.2. | . . . . . . . . . . . . . . . . . . |  52 |
|      | BFCVE Tool                              | . . . . . . . . . . . . . . . . . . |  53 |

Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to PDA Forensic Tools_ an Overview and Analysis:

The purpose of this report is to inform law enforcement, incident response team members, and forensic examiners about the capabilities of present day forensic software tools that have the ability to acquire information from Personal Digital Assistant (PDAs) running the following Operating Systems: Palm OS, Pocket PC, and Linux. An overview of each tool describes the functional range and facilities for acquiring and analyzing evidence contained on PDAs. Generic scenarios were devised to mirror situations that often arise during a forensic examination of PDAs and associated media. The scenarios were used to reveal how selected tools react under various situations. Though generic scenarios were used in analyzing forensic tools, the procedures are not intended to serve as a formal product test or as a comprehensive evaluation. Additionally, no claims are made on the comparative benefits of one tool versus another. The report, instead, offers a broad and probing perspective on the state of the art of present-day forensic tools for PDA devices. It is important to distinguish this effort from the Computer Forensics Tool Testing (CFTT) project, whose objective is to provide measurable assurance to practitioners, researchers, and other users that the tools used in computer forensics investigations provide accurate results. Accomplishing this goal requires the development of rigorous specifications and test methods for computer forensics tools and the subsequent testing of specific tools against those specifications, which goes far beyond the analysis described in this document. The CFFT is the joint effort of the National Institute of Justice, the National Institute of Standards and Technology (NIST), the Office of Law Enforcement Standards (OLES), the U. S. Department of Defense, Federal Bureau of Investigation (FBI), U.S. Secret Service, the U.S. Immigration and Customs Enforcement (BICE), and other related agencies.

PDA Forensic Tools_ an Overview and Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to 2019 NIST_ITL Cybersecurity Program Annual Report:

d networking technologies. See https:/ /www.nist.gov/itl/how-work-us/itl-surf-program. - Opportunities for a temporary assignment of government or military personnel for 6- to 24-month details in ITL.
Qualified individuals should contact itl\_inquiries@ nist.gov to provide qualifications and indicate the area of work that is of interest.

2019 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Directions in Security Metrics Research:

Security Improve with Age?, 15th USENIX Security Symposium, Vancouver, B.C., Canada, July 31-August 4, 2006, http://www.usenix.org/events/sec06/tech/full\_papers/ozment/ozment.pdf
- [Pay06] Shirley C.
Payne, A Guide to Security Metrics, SANS Security Essentials GSEC Practical Assignment, Version 1.2e, June 19, 2006, http://www.sans.org/reading\_room/whitepapers/auditing/55.php
- [Pou08] Kevin Poulsen, Researchers Use PlayStation Cluster to Forge a Web Skeleton Key, Wired Magazine, December 30, 2008, http://blog.wired.com/27bstroke6/2008/12/berlin.html
- [Qua98] Richard E. Quandt, Measurement and Inference in Wine Tasting, Meetings of the Vineyard Data Quantification Society, Ajaccio, Corsica, October 2-3, 1998, http://www.liquidasset.com/corsica.htm
- [Rei07a] Gavin Reid, Peter Mell, Karen Scarfone, CVSS-SIG Version 2 History, Forum of Incident Response and Security Teams, June 13, 2007, http://www.first.org/cvss/history.html
- [Rei07b] Mark Reith, Jianwei Niu, William Winsborough, Apply Model Checking To Security Analysis in Trust Management, C107-0030, University of Texas at San Antonio, January 2, 2007, http://stinet.dtic.mil/cgibin/GetTRDoc?AD=ADA462754&Location=U2&doc=GetTRDoc.pdf
- [Ron02] Juha Röning, Marko Laakso, Ari Takanen, Rauli Kaksonen, PROTOS Systematic Approach to Eliminate Software Vulnerabilities, Invited presentation at Microsoft Research, Seattle, Washington, May 6, 2002, http://www.ee.oulu.fi/research/ouspg/protos/sota/MSR2002-protos/index.html
- [SAI07] Microsoft Windows Server 2003, XP Professional and XP Embedded Security Target, Version 3.0, Science Applications International Corporation, Common Criteria Testing Laboratory, November 19, 2007, http://www.commoncriteriaportal.org/files/epfiles/20080303\_st\_vid10184-st.pdf


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Hardware-Enabled Security_ Container Platform Security Prototype:

An attestation authority provides the definitive answers to these questions. Attestation provides cryptographic proof of compliance, utilizing the root of trust concept to provide actionable security controls by making the information from various roots of trust visible and usable by other entities. Figure 6 illustrates the attestation protocol providing the means for conveying measurements to the challenger. The endpoint attesting device must have a means of measuring the BIOS firmware, low-level device drivers, and OS and other measured components, and forwarding those measurements to the attestation authority. The attesting device must do this while protecting the integrity, authenticity, nonrepudiation, and in some cases, confidentiality of those measurements. 1. The challenger, at the request of a requester, creates a non-predictable nonce (NC) and sends it to the attestation agent on the attesting node, along with the selected list of Platform Configuration Registers (PCRs). 2. The attestation agent sends that request to the TPM as a TPMQuoteRequest with the nonce and the PCR List. 3. In response to the TPMQuote request, the TPM loads the attestation identity key from protected storage in the TPM by using the storage root key (SRK), and performs a TPM Quote command, which is used to sign the selected PCRs and the NC with the private key AIKpriv . Additionally, the attesting agent retrieves the stored measurement log (SML). 4. In the integrity response step, the attesting agent sends the response consisting of the signed quote, signed NC, and the SML to the challenger. The attesting agent also delivers the Attestation Identity Key (AIK) credential, which consists of the AIKpub that was signed by a privacy certificate authority (CA). 5. For the integrity verification step:
- a. The challenger validates if the AIK credential was signed by a trusted Privacy-CA, thus belonging to a genuine TPM.

Hardware-Enabled Security_ Container Platform Security Prototype


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management:

Hardware Asset Management (HWAM) Capability Definition, Overview, and Scope......2 | | 2.1 HWAM Capability Description...............................................................................................2 | | 2.2 HWAM Attack Scenarios and Desired Result.........................................................................2 | | 2.3 Assessment Objects Protected and Assessed by HWAM........................................................5 | | 2.4 Example HWAMData Requirements .....................................................................................6 | | 2.5 HWAM Concept of Operational Implementation ...................................................................8 | | 2.5.1 Collect Actual State...........................................................................................................9 | | 2.5.2 Collect Desired State ......................................................................................................10 | | 2.5.3 Find/Prioritize Defects....................................................................................................10 | | 2.6 SP 800-53 Control Items that Support HWAM.....................................................................10 | | 2.6.1 Process for Identifying Needed Controls........................................................................10 | | 2.6.2 Control Item Nomenclature ............................................................................................11 | | 2.7 HWAM Specific Roles and Responsibilities..........................................................................11 | | 2.8 HWAM Assessment Boundary ..............................................................................................13 | | 2.9 HWAM Actual State and Desired State Specification ..........................................................13 | | 2.10 HWAM Authorization Boundary and Inheritance ..............................................................14 | | 2.11 HWAM Assessment Criteria Recommended Scores and Risk-Acceptance Thresholds......14 | | 2.12 HWAM Assessment Criteria Device Groupings to Consider .............................................14 | | 3.

Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

| Function   | Category                     | Subcategory   | Manufacturing Profile                                                                                | Implementation Overview                                                                                |
|------------|------------------------------|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|            | Asset Management (ID.AM)     | ID.AM-5       | Low Identify and prioritize manufacturing system components and functions based on their classification, criticality, and business value.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Best Practices for Privileged User PIV Authentication provide? (Part 3)

[Assistant]
|
| 1.4 PIV-Based Authentication and Assurance Levels...........................................
| 4                                                                                |
| 2 Best Practices for PIV-Based Privileged                                                                                | User Authentication...........................6                                                                    |
| 2.1 Minimize Privileged Access ............................................................................ | 7                                                                                |
| 2.2 Issue Dedicated Endpoint Devices for Privileged Use.................................... | 8                                                                                |
| 2.3 Integrate LOA-3 and 4 Privileged Authentication Requirements into an Overall Risk-Based Approach ............................................................................................. | 9                                                                                |
| 2.4 Select the Appropriate PIV Authentication Architecture................................ | 10                                                                                |
| 2.5 Select and Implement Other Necessary Security Controls ...........................

Best Practices for Privileged User PIV Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

3.2.4                                                                                | Prevention Capabilities... 3.2.4 describe common security capabilities, divided into four categories: information gathering, logging, detection, and prevention, respectively. 3.2.4 Prevention Capabilities

Most IDPSs offer multiple prevention capabilities; the specific capabilities vary by IDPS technology type.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guidelines for Securing Wireless Local Area Networks (WLANs):

| Executive Summary.................................................................................................................vi                                                                         | Executive Summary.................................................................................................................vi                                                                         | Executive Summary.................................................................................................................vi                                                                         |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. | Introduction ...................................................................................................................... 1                                                                        | Introduction ......................................................................................................................

Guidelines for Securing Wireless Local Area Networks (WLANs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 4)

[Assistant]
0Cr1. ## Keywords

Cryptographic Module Validation Program; CMVP; FIPS 140 testing; FIPS 140; ISO/IEC 19790; ISO/IEC 24759; testing requirement; vendor evidence; vendor documentation; security policy.
## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Supplemental Content

See https://csrc.nist.gov/projects/cmvp/sp800-140-series-info for details about the NIST Special Publication (SP) 800-140x series publications and their relationships to ISO/IEC 19790 and ISO/IEC 24759. ## Audience

This document is intended for use by vendors, testing labs, and the CMVP. ## Table of Contents

Scope ................................................................................................................................ 1

Normative references  ....................................................................................................... 1

Terms and definitions ...................................................................................................... 1

Symbols and abbreviated terms......................................................................................

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

process level. An adverse event can have multiple consequences and different types of impact, at different levels, and in different time frames. For example, the exposure of sensitive information (e.g., personally identifiable information) by a particular mission/business area (e.g., human resources) can have organization-wide consequences and adverse impact with regard to reputation damage; the information system consequence/impact for multiple systems of an attacker more easily overcoming identification and authentication security controls; and the mission/business process consequence/impact (for one or more mission/business areas) of an attacker falsifying information on which future decisions are based. To ensure consistency, organizations determine at Tier 1, how consequences/impacts experienced in different time frames are to be assessed. At Tier 2, mission/business owners may amplify organizational guidance, as appropriate. The types of consequences and impact considered in risk determinations are identified to provide a basis for determining, aggregating, and/or consolidating risk results and to facilitate risk communication. Organizations also provide guidance to Tier 2 and Tier 3 with regard to the extent that risk assessments are to consider the risk to other organizations and the Nation. Organization make explicit any assumptions about the degree of impact/consequences related to specific threat sources (by name or by type) or through specific vulnerabilities (individually or by type). - Information System: Changes can occur in organizational information systems (including hardware, software, and firmware) that can introduce new risk or change existing risk. For example, updates to operating system software can eliminate security capabilities that existed in earlier versions, thus introducing new vulnerabilities into organizational information systems.

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Study of Federal Agency Needs for Information Technology Security provide? (Part 5)

[Assistant]
lysis was based primarily on importance responses. ## FINDINGS AND OBSERVATIONS

## General

Some people are looking for the "silver bullet" for their security concerns, and, of course, there Is none.
The good news, however, is that there were very few of these people among those Interviewed and much of the help requested in the interviews and survey responses already exists or is being developed by NIST and others. Also, many agencies are making a significant effort to identify and solve

their security probiems. Many security needs were expressed in the course of the study. Some were simpie. Some were complicated. Some were tangential. Many were fundamental. Most were Interrelated. The study team noted only 24 percent of the surveys expressed one or more additional needs and only 13 percent provided additional comments. A number of those interviewed expressed appreciation at the opportunity to focus on security, and also to discuss their problems and frustrations. A number of people said they saw the survey as a tool they could use to better understand the security needs of their constituency. Overall, needs related to technical approaches, methodologies, and products were rated higher in average importance than other subgroups of candidate needs. Needs in this group, in turn, consisted of a subgroup addressing "specific security environments" and a subgroup addressing "particular areas of concern." The security environments subgroup included needs related to LANs, linking systems in one security architecture, integrating open system products, secure dial-in and laptops, and database security. This subgroup provided the strongest showing as a subgroup.

A Study of Federal Agency Needs for Information Technology Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Applications Using Approved Hash Algorithms:

population of possibilities and, in that sense, is unpredictable. A random number is an instance of an unbiased random variable, that is, the output produced by a uniformly distributed random process.
Random numbers may, e.g., be obtained by converting suitable stings of random bits (see [SP 800-90A], Appendix B.5 for details). |
| Second preimage                             | A message X' , that is different from a given message X , such that its message digest is the same as the known message digest of X . |
| Second preimage resistance                  | An expected property of a hash function whereby it is computationally infeasible to find a second preimage of a known message digest, See 'Second preimage'. |
| Secret keying material                      | The binary data that is used to form secret keys, such as AES encryption orHMAC keys. |
| Security strength (Also 'bits of security') | A number associated with the amount of work (that is, the number of operations) that is required to break a cryptographic algorithm or system. If 2 N execution operations of the algorithm (or system) are required to break the cryptographic algorithm, then the security strength is N bits. |
| Shall                                       | Used to indicate a requirement of this Recommendation. |
| Shared secret                               | A secret value that has been computed using a key agreement algorithm and is used as input to a key derivation function. |

Recommendation for Applications Using Approved Hash Algorithms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

- improvement opportunities for the organization's policies, plans, processes, procedures, and practices that support cybersecurity risk management to inform efforts under all six Functions. - PROTECT (PR) -Safeguards to manage the organization's cybersecurity risks are used. Once assets and risks are identified and prioritized, PROTECT supports the ability to secure those assets to prevent or lower the likelihood and impact of adverse cybersecurity events, as well as to increase the likelihood and impact of taking advantage of opportunities. Outcomes covered by this Function include identity management, authentication, and access control; awareness and training; data security; platform security (i.e., securing the hardware, software, and services of physical and virtual platforms); and the resilience of technology infrastructure. - DETECT (DE) -Possible cybersecurity attacks and compromises are found and analyzed. DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring. This Function supports successful incident response and recovery activities. - RESPOND (RS) -Actions regarding a detected cybersecurity incident are taken. RESPOND supports the ability to contain the effects of cybersecurity incidents. Outcomes within this Function cover incident management, analysis, mitigation, reporting, and communication. - RECOVER (RC) -Assets and operations affected by a cybersecurity incident are restored. RECOVER supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents and enable appropriate communication during recovery efforts. ## 3.2.

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative. For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST.

3.15. Exception and Error Handling . . . . . . . . . . . . . . . . . . . . . . .

3.15.1. Requirements for Trusted Referees . . . . . . . . . . . . . . . .

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to General Server Security:

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1                                                                                | Executive Summary..............................................................................................................ES-1   |
|---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
| 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Guidelines on Active Content and Mobile Code:

3.1.2 Window of Exposure

Errors of commission or omission invariably occur that create vulnerabilities that allow protection mechanisms to be bypassed or disabled. 3.1.2, February 4, 2002, http://www.

Guidelines on Active Content and Mobile Code


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements:

a lower risk appetite may be less willing to accept risks left unmitigated by the lack of device cybersecurity requirements and thus not willing to omit the requirement if lacking from an IoT device.
Proper understanding of risk appetite and other cybersecurity considerations will require input from IT security personnel.

IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

3.2.2, fifth paragraph, fourth sentence: Changed 'OS' to 'operating system (OS)'                                                                                | 33     |
| 10/10/2019 | Editorial   | Chapter Three, Section 3. 3.2.2. 3.2.2.

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to Secure Web Services:

| ........................................................................3-37 | | | 3.8.5 | Service Recursion | ......................................................................................3-38 | | | Securing the Discovery Service: Secure Interfaces to UDDI and WSDL...............3-38 | Securing the Discovery Service: Secure Interfaces to UDDI and WSDL...............3-38 | | | 3.9 | 3.9.1 | UDDI Structure | ...........................................................................................3-38 | | | 3.9.2 | UDDI Operations | ........................................................................................3-39 | | | 3.9.3 | Secure Access to the Registry | ...................................................................3-40 | | | 3.9.4 | Service Inquiry | API.....................................................................................3-40 | | | 3.9.5 | Service Publishing API | ...............................................................................3-41 | | | 3.9.6 | UDDI and WSDL | ........................................................................................3-42 | | | 3.10 Summary................................................................................................................3-42 | 3.10 Summary................................................................................................................3-42 | | | 4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity of Genomic Data:

This report describes current practices in cybersecurity and privacy risk management for protecting genomic data, along with relevant challenges and concerns identified during 2022 NCCoE-hosted workshops with bioeconomy stakeholders and subsequent related research. Gaps that were identified by stakeholders include: practices across the lifecycle concerning genomic data generation; safe and responsible sharing of genomic data; monitoring the systems processing genomic data; lack of specific guidance documents addressing the unique needs of genomic data processors; and regulatory/policy gaps with respect to national security and privacy threats in the collection, storage, sharing, and aggregation of human genomic data. Cyber attacks targeted at genomic data include attacks against the confidentiality of the data, its integrity, and its availability. Cyber attacks against the confidentiality of the data can threaten our economy through theft of the intellectual property owned by the U.S. biotechnology industry, allowing competitors to gain an unfair economic advantage by accessing U.S. held genomic data. Attacks against the integrity of the data can disrupt biopharmaceutical output, agricultural food production, and bio-manufacturing activity. Attacks against the availability of the data include encrypting for ransom, deletion of data, and disabling critical automated equipment used in research, development, and manufacturing. The potential harms of cyber attacks on genomic data threaten our national security as well, including enabling development of biological weapons and

oppression, and extortion. Genomic database breaches or other losses of data may result in thefts of intellectual property and put the U.S. at a competitive disadvantage in biotechnology. As reported by national security experts, security threats may arise through the creation of bioweapons or compromised identities of national security agents [2][19]-[21].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Trustworthy Email provide?

[Assistant]
## NIST Special Publication 800-177

## Revision 1

## Trustworthy Email

Scott Rose J. Stephen Nightingale Simson Garfinkel Ramaswamy Chandramouli

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-177r1

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-177 Revision 1

## Trustworthy Email

Scott Rose J. Stephen Nightingale * Advanced Network Technology Division Information Technology Laboratory

Simson L. Garfinkel US Census Bureau

Ramaswamy Chandramouli Computer Security Division Information Technology Laboratory

* Former employee; all work for this publication was done while at NIST

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-177r1

February 2019

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

## Authority

�is publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate f ederal officials exercising policy authority over such systems. �is guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.